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The following information has not been updated since the Data 
Protection Act 2018 became law. Although there may be some subtle 
differences between the guidance in this document and guidance 
reflecting the new law - we still consider the information useful to 
those in the media 
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Introduction 


1. The Data Protection Act 1998 (DPA) is based around eight 
principles of good information handling. These give people 
specific rights in relation to their personal information and 
place certain obligations on those organisations that are 
responsible for processing it 


2. An overview of the main provisions of the DPA can be found in 
The Guide to Data Protection. 


3. This is part of a series of guidance, which goes into more detail 
than the Guide, to help data controllers to fully understand 
their obligations and promote good practice. 


4. This guidance explains what local authorities need to consider 
when deciding whether to disclose personal information to 
councillors. 


The role of the councillor 


5. Councillors are likely to have three different roles: 


e they represent residents of their ward, for example, in 
dealing with complaints; 


e they act as a member of the council, for example, as a 
cabinet member or member of a committee; and 


G they may represent a political party, particularly at 
election time. 


6. Depending on the role the councillor has at any one time, the 
local authority may be able to disclose personal information to 
them. In doing so, it will often be necessary to restrict the use 
of any personal information provided for specific purposes. 


Disclosures to councillors representing local residents 


7. A local authority does not generally have to get the express 
consent of an individual to disclose their personal information 
to an elected member, as long as: 
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e the elected member represents the ward in which the 
individual lives; 


° the elected member makes it clear that they are 
representing the individual in any request for their 
personal information to the local authority; and 


o the information is necessary to respond to the individual's 
complaint. 


In these circumstances, the individual has provided implied 
consent to the processing of their personal data that is 
reasonably necessary to pursue the complaint. 


8. There are different requirements when dealing with sensitive 
personal data, which is defined in the DPA as information about 
an individual’s: 


e racial or ethnic origin; 

e political opinions; 

e religious beliefs; 

e trade union membership; 

e health; 

e sexual life; 

e alleged criminal activity; or 


e court proceedings 


There may be occasions when it is advisable to get an 
individual’s signed consent. However, in most cases, the 
individual would reasonably expect their sensitive personal data 
to be disclosed in order to respond to their complaint. The 
Data Protection(Processing of Sensitive Personal Data)(elected 


Representatives) Order 2002 No. 2905 covers this, as it 
provides a basis for: 


G the processing of sensitive personal data by elected 
representatives in connection with their function as a 
representative, including the disclosure of such information 
where necessary; and 
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2 the disclosure of sensitive personal data by organisations 
responding to elected representatives acting on behalf of 
individual constituents. 


When providing personal information to the elected member, 
the local authority should make clear that it is provided only to 
help the individual and must not be used for any other 
purpose. Local authorities may wish to do this for each 
disclosure or more generally lay down a code of practice for 
councillors to follow. It would be good practice to keep a record 
of any requests by elected members for personal information. 


Disclosures to the councillor as a member of the council 


10. 


11. 


Local authorities can disclose personal information to a 
councillor if they need to access and use the information to 
carry out official duties. For this purpose, councillors are in the 
same position as an employee. 


The local authority should consider the following: 


e They should only give the councillor access to the personal 
information they need to carry out their duties. 


Example 


A member of the Housing Committee attends a meeting to 
decide whether or not to seek the eviction of a council tenant. 
The local authority provides the member with all the relevant 
personal information about the tenant and the circumstances 
giving rise to the possible eviction. However, the local 
authority would not be justified in providing the elected 
member with general access to the Housing Department 
system. 


e They should specify the purposes for which that 
information may be used or disclosed. This may be done 
on a case-by-case basis or through developing more 
general procedures and guidelines. 


G Where the councillor is able to take a copy of the personal 
information away from the premises, or where they have 
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remote access to the information, the local authority 
should specify the steps to keep the information secure. 
For example, setting out rules about how personal 
information on a laptop or on paper should be stored 
securely and who can have access to it. 


Disclosures to councillors when representing a political 


party 


12. Local authorities should not normally disclose personal 
information to elected members for political purposes without 
the consent of the individuals concerned. 


13. There are two exceptions to this: 


Sets of personal information which the local authority is 
required to make public, for example, lists of some types 
of licence holder. 

Personal information presented in an aggregated form and 
does not identify any living individuals. For example, 
Council Tax band information or statistical information. 
(However, there would be a breach of the DPA if personal 
information was released in an apparently anonymised 
form which could then be linked to the individuals 
concerned, for example, by comparing property data with 
the electoral roll.) 


Other considerations 


14. Local authorities will usually need to register their processing 
with the Commissioner, in which case, they must make sure 
that their registration includes councillors as a category of 
people who receive personal information from them. 


More information 


15. Specific guidance for elected members is available on our 
guidance pages. Additional guidance is also available there if 
you need further information on other parts of the DPA. 


16. If you need any more information about this or any other 
aspect of data protection, please contact us, or visit our 


website at www.ico.org.uk. 
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